Taking on cloud migration risks
Connecting state and local government leaders
Migrating the Homeland Security Information Network to the cloud involved balancing risks with the need to modernize.
Transferring the Homeland Security Information Network to the cloud only took seven hours, but the team behind the move made extensive preparations for potential complications. Damon Bragg, HSIN service operations manager, explained the biggest risks posed by the move during a June 20 panel at the AWS Public Sector Summit.
The first risk involved the timeline of moving from the data from a Department of Homeland Security data center to the Amazon Web Services GovCloud.
“We were able to slide the [deadline] by five weeks," Bragg said. "We hadn’t secured the right security operations center, so we had to go back and we rework it. We needed to go back and make sure that we had the right eyes on the system at all times."
But, Bragg said, “once we identified the proper [migration] solution and a backup solution, we became rock solid at that point, but that risk rode us the duration of the project.”
Operational responsibility was new risk HSIN faced because it was leaving the “warm and fuzzy nest” of the data center. To make the move quickly, Bragg said his team worked with contractors to create a DevOps team “to help us decide … how we could make the move,” Bragg said. “We had a confident federal staff and fully engaged contractors who were willing to work across some of the grayness to help us get where we needed to be.”
The HSIN team also realized that its plans for using infrastructure as code to manage configurations and automate provisioning of infrastructure didn’t work as expected. After a year spent trying to “automate everything,” the team decided to focus on applications that were mission critical.
Lastly, the move to the cloud meant that HSIN was making a major change in its security posture by getting Federal Risk and Authorization Management authority to operate through the AWS GovCloud. Bragg encouraged other agencies thinking of moving to the cloud to test the security capabilities of the environment “repeatedly and often.”
“We stuck to good IT practices and project management,” Bragg said. “Once we started to do that, we got into a good rhythm where we were able to achieve our objectives.”
NEXT STORY: AWS GovCloud gets more enterprise services